PT-2023-20941 · Pluck Cms · Pluck Cms

Name of the Vulnerable Software and Affected Versions: Pluck CMS versions 4.7.15 through 4.7.16-dev5 Description: A remote code execution issue was found in the /admin.php file of Pluck CMS, allowing attackers to execute arbitrary code through the manage file functionality. Recommendations: For...

Insufficient Validation of Addresses Vulnerability

Lines of code Vulnerability details Summary The code suffers from an insufficient validation of addresses vulnerability. Although it uses the sdk.AccAddressFromBech32 function to convert addresses from Bech32 format to sdk.AccAddress, it fails to validate the addresses for their validity and...

PT-2023-5599 · Tauri · Tauri

Name of the Vulnerable Software and Affected Versions: Tauri versions 1.4.0 Description: The issue is related to a regression in the Filesystem scope check for dotfiles on Unix systems, introduced in the 1.4.0 release. This regression affects Tauri applications using wildcard scopes in the fs...

PT-2023-4058 · Siemens · Ruggedcom Rox Mx5000 +8

Name of the Vulnerable Software and Affected Versions: RUGGEDCOM ROX MX5000 versions prior to V2.16.0 RUGGEDCOM ROX MX5000RE versions prior to V2.16.0 RUGGEDCOM ROX RX1400 versions prior to V2.16.0 RUGGEDCOM ROX RX1500 versions prior to V2.16.0 RUGGEDCOM ROX RX1501 versions prior to V2.16.0...

PT-2023-32981 · Unknown · Passport-Wsfed-Saml2

Name of the Vulnerable Software and Affected Versions: passport-wsfed-saml2 versions prior to 3.0.10 Description: A vulnerability was found in the validation of a SAML signature, where the validation doesn't ensure that the Signature tag is at the proper location inside an Assertion tag. This lea...

PT-2023-4064 · Siemens · Ruggedcom Rox Rx1400 +8

Name of the Vulnerable Software and Affected Versions: RUGGEDCOM ROX MX5000 versions prior to V2.16.0 RUGGEDCOM ROX MX5000RE versions prior to V2.16.0 RUGGEDCOM ROX RX1400 versions prior to V2.16.0 RUGGEDCOM ROX RX1500 versions prior to V2.16.0 RUGGEDCOM ROX RX1501 versions prior to V2.16.0...

PT-2023-5820 · Siemens · Ruggedcom Rox Mx5000 +8

Name of the Vulnerable Software and Affected Versions: RUGGEDCOM ROX MX5000 versions prior to V2.16.0 RUGGEDCOM ROX MX5000RE versions prior to V2.16.0 RUGGEDCOM ROX RX1400 versions prior to V2.16.0 RUGGEDCOM ROX RX1500 versions prior to V2.16.0 RUGGEDCOM ROX RX1501 versions prior to V2.16.0...

[adriro-NEW-M-01]: Forced failure of transactions that use tryCatchLimit

Lines of code Vulnerability details adriro-NEW-M-01: Forced failure of transactions that use tryCatchLimit The same attack described in M-02 can also be exploited with transactions that use tryCatchLimit. Impact Similar to tryCatch, the tryCatchLimit function can be used to execute a transaction...

PT-2023-25170 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 7.3-milestone-1 through 14.4.7 XWiki Platform versions 14.4.8 is not affected, but versions prior to 14.4.8 are affected, the same applies to versions 14.10.6 and 15.1, so the correct format is: XWiki Platform versions...

PT-2023-3471 · Aruba · Arubaos

Name of the Vulnerable Software and Affected Versions: ArubaOS affected versions not specified Description: A vulnerability in the ArubaOS web-based management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting XSS attack against a user of the...

PT-2023-24523 · Enphase · Enphase Envoy

Name of the Vulnerable Software and Affected Versions: Enphase Envoy version D7.0.88 Description: The issue allows an attacker to execute root commands due to a command injection exploit. Recommendations: For Enphase Envoy version D7.0.88, consider disabling or restricting access to the vulnerabl...

PT-2023-23694 · Enphase · Enphase Installer Toolkit

Name of the Vulnerable Software and Affected Versions: Enphase Installer Toolkit version 3.27.0 Description: The issue concerns hard-coded credentials embedded in the binary code of the Android application. An attacker can exploit this to gain access to sensitive information. Recommendations: For...

PT-2023-25146 · WordPress · Internet Marketing Dojo Wp Affiliate Links

Name of the Vulnerable Software and Affected Versions: Internet Marketing Dojo WP Affiliate Links plugin versions 0.1.1 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This allows for malicious scripts to be injected into websites,...

PT-2023-25348 · Unknown · Siren Investigate

Name of the Vulnerable Software and Affected Versions: Siren Investigate versions prior to 13.2.2 Description: The issue concerns session keys remaining active even after a user logs out. This could potentially allow unauthorized access to user sessions. Recommendations: For versions prior to...

PT-2023-24892 · Pybb · Pybb

Name of the Vulnerable Software and Affected Versions: PyBB versions 0.1.0 Description: A manual code review of the PyBB bulletin board server revealed a vulnerability that allows users to submit any type of HTML tag, which can be executed. For example, a malicious tag, such as xss, can be used t...

PT-2023-4128 · Abb · Abb Ability Zenon

Name of the Vulnerable Software and Affected Versions: ABB Ability zenon versions 11 build through 11 build 106404 Description: A vulnerability exists in the zenon system, allowing low-privileged users to read and update data in various directories. This issue can be exploited by attackers using...

PT-2023-6575 · WordPress · Companion Sitemap Generator

Name of the Vulnerable Software and Affected Versions: Companion Sitemap Generator WordPress plugin versions prior to 4.5.3 Description: The issue is related to the lack of protection of the web page structure, allowing for potential exploitation. Specifically, the plugin does not sanitize and...

PT-2023-25304 · WordPress · Beplus Sermon'E – Sermons Online

Name of the Vulnerable Software and Affected Versions: Beplus Sermon'e – Sermons Online plugin versions prior to 1.0.0 Description: A Stored Cross-Site Scripting XSS vulnerability exists, allowing attackers to inject malicious scripts. This issue affects users with contributor or higher...

PT-2023-25017 · Unknown · I-Doit Open

Name of the Vulnerable Software and Affected Versions: i-doit Open version v24 Description: A reflected cross-site scripting XSS issue was found in i-doit Open via the timeout parameter on the "/login" page. This allows for potential XSS attacks. Recommendations: For i-doit Open version v24,...

PT-2023-24977 · Unknown · Jeecg-Boot

Name of the Vulnerable Software and Affected Versions: jjeecg-boot version 3.5.0 Description: The issue concerns an unauthorized arbitrary file upload in the /jeecg-boot/jmreport/upload interface. This allows for potential malicious file uploads without proper authorization. Recommendations: For...